This vulnerability involves a CSRF flaw in the MD Custom content after or before of post plugin by Mukesh Dak, which can be exploited to inject stored XSS payloads. The affected versions are up to 1.0. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to low level. No vendor advisory or patch links are provided, and the plugin is not a cloud service.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This could result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the affected plugin or implementing CSRF protections and input validation as temporary mitigations. Monitor official Mukesh Dak channels for updates.